What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token format made of three Base64URL-encoded parts separated by dots: header.payload.signature. The header describes the signing algorithm, the payload carries claims (like sub, exp, or custom data), and the signature lets a server verify the token hasn't been tampered with.
Decoding vs. verifying
This tool decodes the header and payload — it does not verify the signature. Verifying requires the secret key (HMAC algorithms) or the public key (RSA/ECDSA algorithms) that only the token issuer holds. Since the payload of a JWT is only Base64URL-encoded — not encrypted — anyone can read its contents without the key, which is exactly what this tool does client-side.
Your token never leaves your browser
Decoding happens entirely in JavaScript running on your machine. This matters because JWTs often carry sensitive session data — pasting a production token into a tool that sends it to a server would be a real security risk. This decoder makes no network requests with your token, ever.
FAQ
Why does it say "alg: none — insecure"?
The none algorithm means the token is explicitly unsigned. Some historical vulnerabilities exploited servers that accepted alg: none tokens as valid — if you see this on a token you didn't generate for testing, treat it as a red flag.
What do exp, iat, and nbf mean?
These are registered claims from RFC 7519: iat (issued at), exp (expiration time), and nbf (not before) — all expressed as Unix timestamps in seconds, which this tool converts to a readable date automatically.